Live › vulnerability › CVE-2026-98633
Go to dashboardIn the Linux kernel's btnxpuart Bluetooth driver, a kernel built without CONFIG_DEV_COREDUMP leaks a cloned socket buffer when a firmware dump is processed, and recovery is skipped. The sources describe a memory leak and a missed recovery step, not code execution or data exposure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the NXP btnxpuart Bluetooth driver and CONFIG_DEV_COREDUMP disabled, typically embedded boards with NXP Bluetooth chips. Systems without that driver loaded, or with coredump support enabled, are not affected by this path.
No product ranges from the sources yet.
CONFIG_DEV_COREDUMP disabled, for example with grep CONFIG_DEV_COREDUMP /boot/config-$(uname -r)lsmod | grep btnxpuartEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()
When CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -EOPNOTSUPP without freeing its skb argument. This leaks the cloned skb and also prevents nxp_set_ind_reset() from being called to perform recovery.
Fix by guarding the hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)) call with IS_ENABLED(CONFIG_DEV_COREDUMP).
This page as .md · .json · in your agent: get_signal("CVE-2026-98633")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.